Home Backups: the 3-2-1 Rule, Free Options First

The short version

1. Follow 3-2-1: keep 3 copies of important files, on 2 different kinds of storage, with 1 copy offsite. CISA publishes this rule in its data backup guidance.
2. Start free. On a Mac use Time Machine with an external drive. On Windows use Windows Backup with OneDrive. Both are built in.
3. The free built-in option is enough for many households, as long as you also have one copy away from home.
4. Keep one copy disconnected. CISA says ransomware tries to find and delete or encrypt backups it can reach, so an offline copy matters.
5. Test a restore now and then. A backup you have never restored from is a guess.

This helps reduce risk; it is not a guarantee. This guide shares general information to help reduce risk. It is not a guarantee and it is not professional security advice. Vendor features, plans and menus change, so confirm details on the vendor’s own page before you rely on them.

How we built this guide

Facts come from the pages linked below, read on October 27, 2026: CISA’s Data Backup Options (PDF) (CISA), its #StopRansomware Guide (CISA) and Ransomware 101 (CISA), plus Apple, Microsoft and Backblaze pages. We did not test any of these tools and we leave out prices, since plans change. Everyday Tech Guide is not affiliated with any company named here, and there are no affiliate links on this page.

The 3-2-1 rule, in household terms

• 3 copies: the files on your computer or phone, plus two backups.
• 2 kinds of storage: for example, your computer plus an external drive, plus a cloud service. Two copies on the same drive do not count as two kinds.
• 1 offsite: a cloud backup, or a drive kept at a relative’s home or workplace, so a fire, flood or theft at home does not take every copy.

See our glossary for the 3-2-1 backup rule. Decide first what you cannot replace: family photos and videos, tax and ID documents, work files and the recovery codes from our 2FA guide.

Step 1: free built-in backup on your computer

When the free built-in option is enough: if one Mac with Time Machine or one Windows PC with Windows Backup holds your files, and you keep a second copy somewhere else, you do not need a paid service. For a Windows PC, add an external drive as a second type of storage and keep it unplugged between backups.

Step 2: the offsite copy

Free first: copy your most important files to a second external drive and keep it at a relative’s home or your workplace, swapping it every few months. This costs only the drive and means the copy is disconnected from your home network, which is also the best protection against ransomware.

If you would rather not carry drives around, a cloud backup service handles the offsite copy automatically:

Why one copy should be disconnected

CISA describes ransomware as malware that encrypts your files and demands payment. Its #StopRansomware Guide says to maintain offline, encrypted backups and to test them regularly, and notes that ransomware often tries to find and delete or encrypt backups that it can reach. CISA’s data backup guidance adds that removable media such as an external drive should be unplugged after the backup runs, and that a rolling backup that runs all the time can copy corrupted or infected files into the backup without warning.

For a home this means: after Time Machine or a manual copy finishes, unplug and put away your external drive, or keep a second drive that is only plugged in for the backup. Protect backups with a password or encryption where the tool offers it, and use a strong, unique password. The same guide notes that password managers help; see our password manager guide. Layers of defense helps reduce risk: ransomware often arrives by phishing.

What about phones, cameras and cloud sync?

• Phones: turn on your phone maker’s own backup setting and check what it covers, then copy photos you cannot lose to your computer backup too, so they exist on a second kind of storage.
• Cloud sync is not always a backup. A synced folder mirrors changes, so a deleted or encrypted file can sync too. CISA warns that a rolling backup can copy problems into the backup. Check whether your service keeps older versions of files.
• Security cameras: a microSD card or NVR holds video, but it is not a backup of your other files and is not offsite. See local vs cloud storage for cameras and PoE camera and NVR kits.
• A NAS (network-attached storage) can be one of your two kinds of storage. Keep its software updated and do not expose it to the internet; see the Home Network Health Check and router guide for the network side.

A one-hour household plan

1. List what you cannot replace and where it lives today.
2. Turn on Time Machine or Windows Backup.
3. Copy the same important files to a second drive and plan where it will live offsite.
4. If you want automatic offsite backup, consider a cloud service. Turn on 2FA for it.
5. Unplug the backup drive when it is not backing up.
6. Add a calendar reminder every three months to check the backup ran and open one file from it.

Frequently asked questions

What is the 3-2-1 backup rule?

Keep three copies of your important data (the original plus two backups), on two different types of storage, with one copy stored offsite. CISA's data backup guidance describes this rule.

Is Time Machine or Windows Backup enough?

They are a good start and are free and built in. Time Machine gives you a local copy on an external drive, and Windows Backup copies files and settings to OneDrive. For the full 3-2-1 rule you still want one copy away from home, and an unplugged copy helps against ransomware.

Is OneDrive or iCloud sync the same as a backup?

Not always. Sync tools mirror changes, so deleting a file, or ransomware encrypting it, can sync to the cloud too. CISA says rolling backups can silently copy corrupted or infected files into the backup. Check whether your service keeps old versions, and keep a separate copy.

Should I keep my backup drive plugged in?

Not all the time. CISA says removable media should be unplugged after the backup, because ransomware tries to find and encrypt or delete backups that it can reach.

How often should I test my backup?

CISA recommends testing backups regularly. For a home, a reminder every few months to restore one file is a good habit.

Do I need a paid cloud backup?

Not necessarily. A second external drive kept at another location is a free-to-run way to get the offsite copy. A paid service like Backblaze is more convenient and automatic. Check the vendor's page for current plans and terms.